urlscan.io logo urlscan.io
SecurityTrails logo

paypal-secured.com Open in urlscan Pro
34.98.99.30  Public Scan

Go To Rescan Add Verdict Report
URL: http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Submission Tags: phishing malicious Search All
Submission: On March 05 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 34.98.99.30, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is paypal-secured.com.
This is the only time paypal-secured.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 34.98.99.30 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2.16.186.121 20940 (AKAMAI-ASN1)
2 3.6.152.32 16509 (AMAZON-02)
6 4
Apex Domain
Subdomains		 Transfer
2 godaddy.com
api.aws.parking.godaddy.com — Cisco Umbrella Rank: 33513
857 B
2 wsimg.com
img1.wsimg.com — Cisco Umbrella Rank: 9153
174 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 2
51 KB
1 paypal-secured.com
paypal-secured.com
3 KB
6 4
Domain Requested by
2 api.aws.parking.godaddy.com img1.wsimg.com
2 img1.wsimg.com paypal-secured.com
1 www.google.com paypal-secured.com
1 paypal-secured.com
6 4

This site contains no links.

Subject Issuer Validity Valid
www.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.wsimg.com
Starfield Secure Certificate Authority - G2		 2021-09-24 -
2022-10-26		 a year crt.sh
*.aws.parking.godaddy.com
Go Daddy Secure Certificate Authority - G2		 2022-02-23 -
2023-03-27		 a year crt.sh

This page contains 1 frames:

Primary Page: http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Frame ID: 45F797346CF754A1B27DACB24BF9BB53
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

6
Requests

83 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

229 kB
Transfer

775 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request webscr
paypal-secured.com/webapps/54e79/ 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Protocol
HTTP/1.1
Server
34.98.99.30 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
30.99.98.34.bc.googleusercontent.com
Software
openresty /
Resource Hash
9f5e8ee1fdf8c1b5b2119af8d04edd031b5d69d5a4c0c3c3ab3a160766837ce1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
openresty
Date
Sat, 05 Mar 2022 11:16:51 GMT
Content-Type
text/html
Content-Length
2548
Last-Modified
Tue, 01 Mar 2022 22:13:11 GMT
ETag
"621e9a77-9f4"
X-Adblock-Key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_C0S0bS6Rpx7oNrip9PqWiMYKExiBdFEYvBEs82Atj+vmE8yVps2w6mgxEXq1aA0wS7ttaYZBcfo4yadmVMcxkg
Accept-Ranges
bytes
Via
1.1 google
caf.js
www.google.com/adsense/domains/ 		138 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/adsense/domains/caf.js
Requested by
Host: paypal-secured.com
URL: http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94415f40f9626dff51932d8cd527d9bd093f89b064c3104b20b6c5796d9f5f3e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://paypal-secured.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 05 Mar 2022 11:16:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-afs-ui"
etag
"2388034963448826213"
vary
Accept-Encoding
report-to
{"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
accept-ranges
bytes
expires
Sat, 05 Mar 2022 11:16:51 GMT
2.4ab5b47f.chunk.js
img1.wsimg.com/parking-lander/static/js/ 		391 KB
123 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img1.wsimg.com/parking-lander/static/js/2.4ab5b47f.chunk.js
Requested by
Host: paypal-secured.com
URL: http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.121 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-121.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9e9eea6f0ddf968248d48d950b0a5348bae0909919e6e8f9339bcaa27b8117e1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://paypal-secured.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
_BOuQ9IF4gIiZDQKmbvZ5R08UWOxvoaF
content-encoding
gzip
etag
"25907232b158aa04bf413478df04763b"
x-amz-request-id
ZBPM7S44GPE54DFK
x-amz-server-side-encryption
AES256
content-length
125746
x-amz-id-2
+NMtwP0PqLLGVku/KjuQ2AgSM5Xhhm0Lp7Z7kgD3Zqo5ailYVdzgPmesqa4bggdFN9HBwNHa7wY=
last-modified
Wed, 23 Feb 2022 15:01:55 GMT
date
Sat, 05 Mar 2022 11:16:51 GMT
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 05 Mar 2023 11:16:51 GMT
main.032da9a5.chunk.js
img1.wsimg.com/parking-lander/static/js/ 		243 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img1.wsimg.com/parking-lander/static/js/main.032da9a5.chunk.js
Requested by
Host: paypal-secured.com
URL: http://paypal-secured.com/webapps/54e79/webscr?cmd=_login-run&dispatch=191ed96b2b69056f56ba8575db448b5e
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.121 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-121.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9a4b378c8a2d641724e6c7c885c681d74a9943d4e18d9b326a64b5a2fb2cae89

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://paypal-secured.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
udJKV5gqHw9PPlh41HlO.gFAsQqN6CmT
content-encoding
gzip
etag
"b30e58bf0dee35bcd236852be37e10d8"
x-amz-request-id
N7YAB6QM90MY7T45
x-amz-server-side-encryption
AES256
content-length
51089
x-amz-id-2
3/9b92AEZFl8AccstHj0s7yEPb1jHQCeCsH/fomZIciSm2FbpuKxg8KYJgu41zlzPWCGrjVgs+M=
last-modified
Wed, 23 Feb 2022 15:01:55 GMT
date
Sat, 05 Mar 2022 11:16:51 GMT
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 05 Mar 2023 11:16:51 GMT
paypal-secured.com
api.aws.parking.godaddy.com/v1/parking/landers/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.aws.parking.godaddy.com/v1/parking/landers/paypal-secured.com?trafficTarget=reseller
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.6.152.32 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-6-152-32.ap-south-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
x-request-id
Origin
http://paypal-secured.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sat, 05 Mar 2022 11:16:52 GMT
content-length
0
access-control-allow-credentials
true
access-control-allow-headers
X-Request-Id
access-control-allow-methods
GET, HEAD, OPTIONS
access-control-allow-origin
http://paypal-secured.com
access-control-max-age
600
x-request-id
vqaXtz0k
paypal-secured.com
api.aws.parking.godaddy.com/v1/parking/landers/ 		336 B
857 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.aws.parking.godaddy.com/v1/parking/landers/paypal-secured.com?trafficTarget=reseller
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/parking-lander/static/js/main.032da9a5.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.6.152.32 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-6-152-32.ap-south-1.compute.amazonaws.com
Software
/
Resource Hash
0155f57fce44cca0b5fa0f435f2ef1d67fce05d431f3f8f231d8edf6ca4cce20

Request headers

Referer
http://paypal-secured.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
X-Request-Id
38b6b6c8-8a57-4ecb-8159-7ef0ac2ca75d

Response headers

access-control-allow-origin
http://paypal-secured.com
date
Sat, 05 Mar 2022 11:16:52 GMT
access-control-allow-credentials
true
content-length
336
access-control-max-age
600
x-request-id
38b6b6c8-8a57-4ecb-8159-7ef0ac2ca75d
content-type
application/json

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored number| googleNDT_ number| googleAltLoader object| google string| LANDER_SYSTEM object| webpackJsonpparking-lander function| setImmediate function| clearImmediate object| regeneratorRuntime

6 Cookies

Domain/Path Name / Value
paypal-secured.com/ Name: system
Value: PW
paypal-secured.com/ Name: caf_ipaddr
Value: 217.64.151.8
paypal-secured.com/ Name: country
Value: SE
paypal-secured.com/ Name: city
Value: "Stockholm"
paypal-secured.com/ Name: traffic_target
Value: reseller
api.aws.parking.godaddy.com/ Name: AWSALBCORS
Value: WvkfG+VfWLvIcKCtx/FWfeT87Gf/UcgloFVUud2tZ+eh7mbgzo/c2EPJo+FROxkJXUJwL1noAj/3GnA02Rp0xdWjz3/v1i7DDNJ4HzMllOncyrj0htbWhnAuopTW